I've looked at this question a bit more closely, and it seems that the Baseline Requirements for WebPKI do not require key rotation unless key compromise is known to have occurred. In other words, while you must get new certificates regularly, you can continue to use the same keypair for them, as long as it continues to meet the security requirements and you don't think it's been stolen. It seems they have judged certificate mis-issuance to be a much more likely threat than key theft. I'm not sure if that same premise would still apply to e-mail, but I wanted to make this correction.